[quality] 4 tests read/write live /data paths — fail (or mutate production state) on hive hosts

## Finding Running `go test ./pkg/... -short` on a hive host (where `/data` exists and holds live state) fails 3 packages that are green in CI. The failures are hermeticity bugs — tests depend on fixed production paths: 1. **pkg/scheduler** `TestLoadPromptTemplate_FromPoliciesDir`: `loadPromptTemplate` checks `/data/agents//CLAUDE.md` and `/data/policies/...` *before* the test's temp `Policies.LocalDir`. On a host with a live scanner agent, the test reads the real production policy and fails asserting the temp template. (`src/pkg/scheduler/scheduler.go:132-140` — only `userSavedPolicyDir` is a test seam; the other two paths are inline literals.) 2. **pkg/tokens** `TestCollector_Summary_Initially`: `NewCollector` eagerly calls `loadSnapshot()` on `defaultPersistPath = "/data/token-summary.json"` (`src/pkg/tokens/collector.go:75,106`). `SetPersistPath` exists but comes too late — the constructor has already loaded the **live production token summary** (test output showed real per-agent totals for the running hive). Test expects nil and fails. 3. **pkg/proxy** `TestNewGitHubProxy`, `TestNewGitHubProxyWithWritableDir`: `NewGitHubProxy` writes the CA to fixed `/data/proxy-ca.pem`. Where `/data` is read-only the tests fail (`permission denied`); where it is writable, **the test would overwrite the live proxy CA** — worse than a failure. CI stays green only because runners have no `/data`, so the reads fall through to defaults. That means the tests silently exercise different branches in CI vs. on real hosts, and running the suite on a production hive host is unsafe. ## Recommendation - `tokens`: make snapshot loading lazy or add a constructor/option taking the persist path, so `SetPersistPath` (or a new option) applies before the first load; point tests at `t.TempDir()`. - `scheduler`: promote the inline `/data/agents/...` and `/data/policies/examples/...` literals to package-level vars (same pattern as `userSavedPolicyDir`) and override them in tests. - `proxy`: thread the CA path through config/parameter instead of the `/data/proxy-ca.pem` literal; tests use `t.TempDir()`. - Optionally add a CI lane that runs the suite with a populated `/data` fixture to catch future regressions of this class. These need small production seams (path parameterization), so the quality agent is not PRing them directly (testing-only mandate). ## Priority - Impact: high (suite unsafe/red on production-shaped hosts; live CA overwrite risk) - Effort: low-medium (mechanical path seams + test updates) --- *Filed by quality agent (hold-gated mode)* --- 🐝 **Hive Agent**: `quality` | **Instance:** `hosted-available-oke-11-placeholder-r05x` | **SHA:** `unknown` — hive: agent=quality backend=copilot model=claude-fable-5